Table of Contents

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX and Windows. It also includes agentless monitoring for use with for example Cisco, HP or Juniper hardware.

This tutorial covers the installation of the OSSEC 2.8.0 server, the standard OSSEC Web UI and the Analogi dashboard on Ubuntu 14.04. It also covers OSSEC setup with MySQL support. Last but not least it shows you how to install the OSSEC agent on a *NIX system.

This tutorial is written for an Ubuntu 14.04 OSSEC 2.8.0 server, but can be easily adapted to other *NIX operating systems. It only covers basic OSSEC client/server configuration. It gets you started, the rest is available in the documentation: http://www.ossec.net/doc/

We use version 0.8 of Web UI because there are a lot of errors (like broken search) in the stable 0.3 version. We also set the correct permissions on the tmp/ folder. Afterwards the web ui is visible at http://hostname/ossec/.

Installing Analogi Web Dashboard

The Analogi dashboard is a nice and informative dashboard around OSSEC, which provides more visual information then the standard Web UI. The standard Web UI has better search functions, the Dashboard can be used for example on a Wall Mounted monitor and such.

Installation consists out of cloning the git repo and editing the settings file:

Client OSSEC config

Adding a client to OSSEC is quite simple. First you add the client to the server, which gives you a key. Then you add this key to the client, edit the config file on the client and that's it.

First we need to generate a key on the OSSEC server for this client. We do this by running /var/ossec/bin/manage_agents, option A, then entering the hostname, IP and ID for the client we want to add. Do this on the OSSEC server:

Ignoring rules

To very simply ignore rules based on rule id, add them to the XML file located in /var/ossec/rules/local_rules/xml, either on the ossec client for one machine or the ossec server to ignore on all machines: